Express Mail Label No. 



Dated: . 



Docket No.: 03042/OOOG956-USO 
(PATENT) 



IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 



In re Patent Application of: 
James D. Marks 

Application No.: 09/556,945 

Filed: April 21, 2000 



Art Unit: 3626 

Examiner: Robert W. Morgan 



For: SYSTEM AND METHOD FOR 

RECRUITMENT OF CANDIDATES FOR 
CLINICAL TRIALS WHILE MAINTAINING 
SECURITY 



SECOND DECLARATION OF BONNIE GOLDMAN 



Commissioner for Patents 

P.O. Box 1450 

Alexandria, VA 22313-1450 

Dear Sir: 

I, Bonnie Goldman, hereby declare and state as follows: 

1 . I am a citizen of the United States and am more than twenty-one years of age. 

2. From August 1995 to November 18, 1999, 1 was employed by Body Health 
Resources Corporation ("BHRC") as a consultant with the title Content Manager. Since November 
19, 1999, 1 have been an employee of BHRC. As a consultant and an employee, I have worked on 
behalf of and under the direct supervision and control of James D. Marks, Founder and Chief 
Executive Officer. 
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Declaration Under 37 C.F.R, § 1.131 

3. This Declaration supplements a Declaration earlier made by me on August 
19, 2004, and which, upon information and belief, was transmitted to the United States Patent & 
Trademark Office on August 19, 2004, 

4. The following paragraphs describe work that was completed by me, along 
with individuals working on my behalf and under my supervision and control. The work was 
completed in the United States, 

5. I directed the design and implementation of web site pages on 
www.thebody.com presenting a Health Survey Questionnaire and accompanying information about 
the purpose and use of the Questionnaire (including information about the protection of privacy of 
the respondents, the confidentiality of the responsive data, the ablility of respondents subsequently 
to remove themselves from BHRC's list, and a participation agreement). The purpose of the Health 
Survey Questionnaire was to solicit health and contact information from members of the public, 
provided with gratuitous access to the web site, for possible participation in one or more upcoming 
clinical trials. The Health Survey Questionnaire was first installed on a server for posting on 
www.thebody.com and made accessible to members of the public through access to 
www.thebody.com via the Internet between May 21, 1999 and, at the latest, May 24, 1999, the first 
date for which www.thebody.com received responses to the Questionnaire. (For the responses, see 
Exhibit C of my Declaration of August 19, 2004). Responses were encrypted and transmitted 
securely to the server on which the Health Survey Questionnaire was installed. 

6. As of May 24, 1999 at the latest, the Health Survey Questionnaire accessible to 
members of the public included at least the following web site pages posted at www.thebody.com: 
The page headlined, "Volunteer for Research," at 
http://www.thebodv.com/sui-vevs/health survev.html (substantially in the form attached as Exhibit 
G of the Declaration of Christopher Andrews), the page headlined, "Volunteer for Research! 
Participation Agreement," at http://www.thebody.com/survevs/health survevl.html (substantially in 
the form attached as Exhibit H of the Declaration of Christopher Andrews), the page headlined, 
"Health Survey," at http://www.tliebodv.coni/survevs/health survev2a.ihtml (substantially in the 
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form beginning on page 8 of Exhibit L, attached to the Second Declaration by James D. Marks 
dated October 31, 2007), and the page headlined, "Removing Your Name from The Body's List of 
Volunteers for Research," at http://www.thebodyxom/surveys/health_remove.ihtml. Upon 
information and belief, the Removal Page was substantially in the form later captured on September 
12, 1999 at archive.org (an entity independent of BHRC), which may be viewed currently at 
http://web.archive.org/web/! 9990912024121/http://www.thebodyxom/surveys/health_remove.ihtml 
a current hardcopy of which is attached as Exhibit P. This page provided the tillable form further 
described in paragraph 1 1 . 

7. In order to avoid releasing confidential information during the removal process, 
removal requests, like registrations, were encrypted and transmitted securely to the server on which 
the Health Survey Questionnaire was installed. This avoided a potential security hole, because if 
people with HIV revealed their identities or medical information in ordinary email requesting 
removal, such email could be intercepted and read by unintended parties. The page headlined 
"Health Survey", which is attached as Exhibit L to the Second Declaration by James D. Marks dated 
October 31, 2007, required registrants to provide their birthdates for at least the reason that BHRC 
could use birthdate to verify identity in case BHRC later received a request for removal that 
purported to be from the registrant. Accordingly the Removal Page as well was designed to collect 
birthdate, as further described in paragraph 11. 

8. The pages posted at TheBody.com headlined, "Volunteer for Research" and 
"Volunteer for Research! Participation Agreement," in addition to being substantially in the form of 
Exhibits G and H in the Declaration of Christopher Andrews, were moreover as of May 24, 1999 
substantially in the form later captured at archive.org (showing jpg graphics) on October 2, 1999 
and on July 12, 2000 respectively, located respectively at the following URLs: 
http://web.archive.org/web/19991002035408 survev.htmL 
http://web.archive.org/weW survevl.html 
and are attached respectively in current hardcopy form as Exhibits Q and R. The headline changed 
on the Participation Agreement page between May 24, 1999 and July 12, 2000, from "Volunteer for 
Research! Participation Agreement/* to "Applying for Clinical Studies and Research/Participation 
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Agreement," but the substance of the page remained the same, and specifically it always contained 
the link to the Removal Page further described in paragraph 10. 

9. I also directed the design and implementation of a secure database for BHRC 
in which the data entered in response to the Health Survey Questionnaire and to the Removal Page 
was transmitted, stored and accessed by Dahlia Elsayed, an employee of BHRC at the relevant time. 
The secure database resulting from the responses to the Questionnaire contained personal and 
medical information from multiple members of the public. 

10. Prior to May 24, 1999, upon information and belief, I and/or the individuals 
working on my behalf and under my supervision and control ("we") tested the web site pages which 
provided links to the Removal Page. Specifically, we confirmed that functioning links to the 
Removal Page were coded into the following text: into "Please remove my name as a volunteer" on 
the web site page http://www.thebody.com/sui*vevs/health survey.html and into the underlined 
portion of, "This release shall be effective for a perpetual duration, but you may subsequently 
request that The Body no longer provide information to clinical researchers " on the web site page 
http://www.thebodv.com/survevs/health survey 1 .html . 

11. Prior to May 24, 1999, upon information and belief, we further confirmed 
that a fillable form provided on the Removal page for requesting, once registered, withdrawal from 
possible participation in upcoming clinical trials was operable to receive name and identifying 
information (a "birthdate") of a registered individual, and confirmed that the Removal Page was 
further operable to transmit this information in encrypted form to the server on which the Health 
Survey Questionnaire was located by operation of a "submit" button on the Removal Page. 

12. Prior to May 24, 1999, upon information and belief, I provided instructions to 
Dahlia Elsayed, an individual working on my behalf and under my supervision and control, to 
download the encrypted responses to the Health Survey Questionnaire together with encrypted 
withdrawal requests, to decrypt them, to store them in an electronic database at our office, to print 
hard copies of the downloaded data, and to store the electronic and hard copy data in a secure 
fireproof file cabinet located at the office of BHRC in strict accordance with privacy and 
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confidentiality policies for the responses to the Questionnaire. A summary of these instructions is 
provided in my Declaration of August 19, 2004, Upon information and belief, I further instructed 
Dahlia Elsayed to fully delete the stored responses for whom withdrawal requests had been 
received. 

13. I further declare that all statements made herein are of my own knowledge 
and are true, and that all statements made on information and belief are believed to be true. I further 
declare that these statements are made with the knowledge that willful false statements and the like 
so made are punishable by fine or imprisonment or both, under Section 1001 of Title 18 of the 
United States code, and that such willful false statements may jeopardize the validity of the instant 
application or of any patent issued thereupon. 

Dated: Orh> 3/ -=h 
Attachments: 

Exhibit P: Copy of "Removing Your Name from The Body's List of Volunteers for 
Research" Page 

Exhibit Q: Copy of "Volunteer for Research" Page 

Exhibit R: Copy of "Applying for Clinical Studies and Research/Participation Agreement" 
Page 
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